US8667268B2 - Scalable distributed web-based authentication - Google Patents
Scalable distributed web-based authentication Download PDFInfo
- Publication number
- US8667268B2 US8667268B2 US13/461,700 US201213461700A US8667268B2 US 8667268 B2 US8667268 B2 US 8667268B2 US 201213461700 A US201213461700 A US 201213461700A US 8667268 B2 US8667268 B2 US 8667268B2
- Authority
- US
- United States
- Prior art keywords
- packet
- network switch
- switch
- processors
- transport protocol
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/25—Routing or path finding in a switch fabric
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/35—Switches specially adapted for specific applications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0485—Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/16—Implementing security features at a particular protocol layer
- H04L63/166—Implementing security features at a particular protocol layer at the transport layer
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
Definitions
- the present invention relates to the field of computer science. More particularly, the present invention relates to scalable distributed Web-based authentication.
- An enterprise network may provide access to sensitive proprietary data and critical resources. Authentication is used to prevent unauthorized users from accessing enterprise resources. Examples of such enterprise resources include access to the intranet, access to the Internet, and access to a data center.
- Web-based user authentication uses a combination of existing technologies, including Web browsers, Web content servers and secure and non-secure Internet communications protocols.
- a user attempting to access network resources for the first time is challenged for a user login name and password.
- a secure communication transport protocol such as Secure Sockets Layer (SSL)
- SSL Secure Sockets Layer
- An Authentication, Authorization and Accounting (AAA) protocol such as Remote Authentication Dial In User Service (RADIUS) or Lightweight Directory Access Protocol (LDAP) is typically used to authenticate the credentials.
- RADIUS Remote Authentication Dial In User Service
- LDAP Lightweight Directory Access Protocol
- Web-based user authentication solutions are typically single-processor-based. As such, both plaintext and encrypted traffic are handled by the same processor, which can lead to both inefficient CPU usage and compromised handling of other critical network traffic. In addition, such solutions are typically ill-equipped to handle processor failures and cannot scale easily to handle additional users, particularly in multi-VLAN (Virtual Local Area Network) enterprise network environments. Accordingly, a need exists in the art for an improved solution for Web-based user authentication.
- Web-based authentication includes receiving a packet in a network switch having at least one associative store configured to forward packet traffic to a first one or more processors of the switch that are dedicated to cryptographic processing if a destination port of the packet indicates a secure transport protocol, and to a second one or more processors of the switch that are not dedicated to cryptographic processing if the destination port does not indicate a secure transport protocol.
- a source of the packet is an authenticated user
- the packet is forwarded via an output port of the switch, based on the associative store.
- the source is an unauthenticated user
- the packet is forwarded to the first one or more processors if the destination port indicates a secure transport protocol, and to the second one or more processors if the destination port does not indicate a secure transport protocol.
- FIG. 1 is a block diagram of a computer system suitable for implementing aspects of the present invention.
- FIG. 2 is a block diagram that illustrates a scalable distributed architecture for Web-based authentication in accordance with one embodiment of the present invention.
- FIG. 3 is a block diagram that illustrates a scalable distributed architecture for Web-based authentication in accordance with one embodiment of the present invention.
- FIG. 4 is a block diagram that illustrates a scalable distributed architecture for Web-based authentication in accordance with one embodiment of the present invention.
- FIG. 5 is a flow diagram that illustrates a method for Web-based authentication in accordance with one embodiment of the present invention.
- FIG. 6 is a flow diagram that illustrates a method for Web-based authentication in accordance with one embodiment of the present invention.
- FIG. 7 is a flow diagram that illustrates a method for Web-based authentication in accordance with one embodiment of the present invention.
- FIG. 8 is a flow diagram that illustrates a method for forwarding a packet to a first one or more processors of a switch dedicated to cryptographic processing in accordance with one embodiment of the present invention.
- FIG. 9A is a block diagram that illustrates a method for forwarding a packet to a first one or more processors of a switch dedicated to cryptographic processing in accordance with one embodiment of the present invention.
- FIG. 9B is a block diagram that illustrates a method for forwarding a packet to a first one or more processors of a switch dedicated to cryptographic processing in accordance with one embodiment of the present invention.
- FIG. 10 is a flow diagram that illustrates a method for Web-based authentication in accordance with one embodiment of the present invention.
- FIG. 11 is a block diagram that illustrates a scalable distributed architecture for Web-based multi-VLAN authentication in accordance with one embodiment of the present invention.
- FIG. 12 is a block diagram that illustrates a scalable distributed architecture for Web-based multi-VLAN authentication on the aggregation layer in accordance with one embodiment of the present invention.
- Embodiments of the present invention are described herein in the context of scalable distributed Web-based authentication. Those of ordinary skill in the art will realize that the following detailed description of the present invention is illustrative only and is not intended to be in any way limiting. Other embodiments of the present invention will readily suggest themselves to such skilled persons having the benefit of this disclosure. Reference will now be made in detail to implementations of the present invention as illustrated in the accompanying drawings. The same reference indicators will be used throughout the drawings and the following detailed description to refer to the same or like parts.
- the components, process steps, and/or data structures may be implemented using various types of operating systems (OS), computing platforms, firmware, computer programs, computer languages, and/or general-purpose machines.
- the method can be run as a programmed process running on processing circuitry.
- the processing circuitry can take the form of numerous combinations of processors and operating systems, connections and networks, data stores, or a stand-alone device.
- the process can be implemented as instructions executed by such hardware, hardware alone, or any combination thereof.
- the software may be stored on a program storage device readable by a machine.
- the components, processes and/or data structures may be implemented using machine language, assembler, C or C++, Java and/or other high level language programs running on a data processing computer such as a personal computer, workstation computer, mainframe computer, or high performance server running an OS such as Solaris® available from Sun Microsystems, Inc. of Santa Clara, Calif., Windows VistaTM, Windows NT®, Windows XP, Windows XP PRO, and Windows® 2000, available from Microsoft Corporation of Redmond, Wash., Apple OS X-based systems, available from Apple Inc. of Cupertino, Calif., or various versions of the Unix operating system such as Linux available from a number of vendors.
- OS such as Solaris® available from Sun Microsystems, Inc. of Santa Clara, Calif., Windows VistaTM, Windows NT®, Windows XP, Windows XP PRO, and Windows® 2000, available from Microsoft Corporation of Redmond, Wash., Apple OS X-based systems, available from Apple Inc. of Cupertino, Calif., or various versions of the Uni
- the method may also be implemented on a multiple-processor system, or in a computing environment including various peripherals such as input devices, output devices, displays, pointing devices, memories, storage devices, media interfaces for transferring data to and from the processor(s), and the like.
- a computer system or computing environment may be networked locally, or over the Internet or other networks.
- Different implementations may be used and may include other types of operating systems, computing platforms, computer programs, firmware, computer languages and/or general-purpose machines; and.
- network includes local area networks (LANs), wide area networks (WANs), metro area networks, residential networks, corporate networks, inter-networks, the Internet, the World Wide Web, cable television systems, telephone systems, wireless telecommunications systems, fiber optic networks, token ring networks, Ethernet networks, ATM networks, frame relay networks, satellite communications systems, and the like.
- LANs local area networks
- WANs wide area networks
- metro area networks residential networks
- corporate networks corporate networks
- inter-networks the Internet
- the World Wide Web cable television systems
- telephone systems wireless telecommunications systems
- fiber optic networks token ring networks
- Ethernet networks ATM networks
- frame relay networks frame relay networks
- satellite communications systems and the like.
- identifier describes an ordered series of one or more numbers, characters, symbols, or the like. More generally, an “identifier” describes any entity that can be represented by one or more bits.
- the term “distributed” describes a digital information system dispersed over multiple computers and not centralized at a single location.
- processor describes a physical computer (either stand-alone or distributed) or a virtual machine (either stand-alone or distributed) that processes or transforms data.
- the processor may be implemented in hardware, software, firmware, or a combination thereof.
- data store describes a hardware and/or software means or apparatus, either local or distributed, for storing digital or analog information or data.
- the term “Data store” describes, by way of example, any such devices as random access memory (RAM), read-only memory (ROM), dynamic random access memory (DRAM), static dynamic random access memory (SDRAM), Flash memory, hard drives, disk drives, floppy drives, tape drives, CD drives, DVD drives, magnetic tape devices (audio, visual, analog, digital, or a combination thereof), optical storage devices, electrically erasable programmable read-only memory (EEPROM), solid state memory devices and Universal Serial Bus (USB) storage devices, and the like.
- RAM random access memory
- ROM read-only memory
- DRAM dynamic random access memory
- SDRAM static dynamic random access memory
- Flash memory hard drives, disk drives, floppy drives, tape drives, CD drives, DVD drives, magnetic tape devices (audio, visual, analog, digital, or a combination thereof), optical storage devices, electrically erasable programmable read-only memory (EEPROM), solid
- network interface describes the means by which users access a network for the purposes of communicating across it or retrieving information from it.
- Web server describes a computer system that stores and/or serves Web pages and/or data ready for access by other computers.
- system describes any computer information and/or control device, devices or network of devices, of hardware and/or software, comprising processor means, data storage means, program means, and/or user interface means, which is adapted to communicate with the embodiments of the present invention, via one or more data networks or connections, and is adapted for use in conjunction with the embodiments of the present invention.
- the term “user authentication” describes the verification of the digital identity of the sender of a communication such as a request to log in.
- the term “associative store” describes a component configured to search a data store to determine whether a received data word is stored anywhere in the data store. If the data word is found, the associative store returns a list of one or more storage addresses where the data word was found. The associative store optionally returns the data word, or other associated data.
- An associative store may be a content-addressable memory (CAM), also known as an associative memory.
- CAM content-addressable memory
- an associative store may be based on a linear table search or a binary table search.
- Example embodiments of the present invention provide a method and system for Web-based authentication for use in a multiprocessor edge switch or aggregation layer switch.
- An edge switch solution can be used to block an unauthorized user at the outermost periphery of an enterprise network.
- An aggregation switch solution achieves economy of scale by centralizing the task authentication of multiple users in a single network device.
- Example embodiments of the present invention use a multiprocessor network switch architecture to efficiently forward packet traffic within the network switch based on one or more of traffic load, traffic type, and the computing capabilities of particular processors.
- Traffic load may be determined based on a client Internet Protocol (IP) address.
- Traffic type may include an indication of whether the packet traffic is plaintext or encrypted.
- the computing capabilities of a processor may include an indication of whether the processor has cryptographic encoding resources, cryptographic decoding resources, or both.
- Example embodiments of the present invention forward encrypted traffic to one set of processors and unencrypted traffic to another set of processors, thereby removing cryptographic key processing as a bottleneck in Web-authentication processing and increasing Web-authentication throughput while minimizing any impact on packet forwarding of traffic not subject to Web-based authentication.
- traffic distribution in a multi-processor network switch is achieved by extracting fields of interest from a received packet and performing a lookup based on the extracted fields.
- the lookup may be done using an associative store.
- the associative store is configured to forward traffic whose destination IP address is associated with the multi-processor network switch and whose destination port indicates a secure communication transport protocol such as SSL to one or more processors dedicated to cryptographic processing, and all other traffic to one or more processors not dedicated to cryptographic processing.
- user IP address hashing is used in processor selection so that packet traffic of the same type from the same user is directed to the same processor.
- FIG. 1 depicts a block diagram of a computer system 100 suitable for implementing aspects of the present invention.
- system 100 includes a bus 102 which interconnects major subsystems such as a processor 104 , an internal memory 106 (such as a RAM), an input/output (I/O) controller 108 , a removable memory (such as a memory card) 122 , an external device such as a display screen 110 via display adapter 112 , a roller-type input device 114 , a joystick 116 , a numeric keyboard 118 , an alphanumeric keyboard 118 , directional navigation pad 126 and a wireless interface 120 .
- Many other devices can be connected.
- Wireless network interface 120 wired network interface 128 , or both, may be used to interface to a local or wide area network (such as the Internet) using any network interface system known to those skilled in the art.
- Code to implement the present invention may be operably disposed in internal memory 106 or stored on storage media such as removable memory 122 , a floppy disk, a thumb drive, a CompactFlash® storage device, a DVD-R (“Digital Versatile Disc” or “Digital Video Disc” recordable), a DVD-ROM (“Digital Versatile Disc” or “Digital Video Disc” read-only memory), a CD-R (Compact Disc-Recordable), or a CD-ROM (Compact Disc read-only memory).
- removable memory 122 a floppy disk, a thumb drive, a CompactFlash® storage device, a DVD-R (“Digital Versatile Disc” or “Digital Video Disc” recordable), a DVD-ROM (“Digital Versatile Disc” or “Digital Video Disc” read-only memory), a CD-R (Compact Disc-Recordable), or a CD-ROM (Compact Disc read-only memory).
- DVD-R Digital Versatile Disc” or “
- FIG. 2 is a block diagram that illustrates a scalable distributed architecture for Web-based authentication in accordance with one embodiment of the present invention.
- network switch 200 comprises an associative store 208 , one or more input ports ( 210 - 214 ), one or more output ports ( 216 - 220 ), and a processor group 202 comprising one or more processors dedicated to cryptographic processing 204 and one or more processors not dedicated to cryptographic processing 206 .
- Input ports 210 - 214 are coupled to associative store 208 and configured to receive one or more packets on a packet-switched network.
- Output ports 216 - 220 are coupled to processor group 202 and associative store 208 and are configured to send one or more packets to the packet-switched network.
- Associative store 208 is configured to forward packet traffic to the one or more processors dedicated to cryptographic processing 204 if the destination port of the received packets indicates a secure communication transport protocol, such as SSL.
- Associative store 208 is further configured to forward packet traffic from the network switch 200 to the one or more processors not dedicated to cryptographic processing 206 if the destination port of the received packets does not indicate a secure communication transport protocol.
- Associative store 208 is further configured to forward packets directly from one of input ports 210 - 214 if the packets are from a user device that has been authenticated.
- the one or more processors dedicated to cryptographic processing 204 are configured to perform cryptographic processing on packets
- the one or more processors not dedicated to cryptographic processing 206 are configured to perform non-cryptographic processing on the packets.
- One of the one or more processors not dedicated to cryptographic processing 206 is further configured to control networking functions other than forwarding, such as user authentication, Dynamic Host Configuration Protocol (DHCP) snooping, user entry table creation, deletion, and associative store entry aging, user device address (e.g. Media Access Control (MAC) address) learning, Web server IP address management, and the like, and to perform inter-processor synchronization to update the other processors with current information.
- DHCP Dynamic Host Configuration Protocol
- MAC Media Access Control
- FIG. 3 is a block diagram that illustrates a scalable distributed architecture for Web-based authentication in accordance with one embodiment of the present invention.
- FIG. 3 is similar to FIG. 2 , except FIG. 3 includes a master processor 340 configured to control networking functions other than forwarding, such as user authentication, Dynamic Host Configuration Protocol (DHCP) snooping, user entry table creation, synchronization, deletion, and associative store entry aging, user device address (e.g. Media Access Control (MAC) address) learning, Web server IP address management, and the like.
- DHCP Dynamic Host Configuration Protocol
- MAC Media Access Control
- network switch 300 comprises an associative store 308 , one or more input ports ( 310 - 314 ), one or more output ports ( 316 - 320 ), a slave processor group 302 comprising one or more processors dedicated to cryptographic processing 304 and one or more processors not dedicated to cryptographic processing 306 .
- Network switch 300 also comprises a master processor 340 .
- Input ports 310 - 314 are coupled to associative store 308 and configured to receive one or more packets on a packet-switched network.
- Output ports 316 - 320 are coupled to master processor 340 and are configured to send one or more packets to the packet-switched network.
- Associative store 308 is configured to forward packet traffic to the one or more processors dedicated to cryptographic processing 304 if the destination port of the received packets indicates a secure communication transport protocol, such as SSL. Associative store 308 is further configured to forward packet traffic from the network switch 300 to the one or more processors not dedicated to cryptographic processing 306 if the destination port of the received packets does not indicate a secure communication transport protocol. Associative store 308 is further configured to forward packets directly from one of input ports 310 - 314 if the packets are from a user device that has been authenticated.
- a secure communication transport protocol such as SSL
- the one or more processors dedicated to cryptographic processing 304 are configured to perform cryptographic processing on packets, and the one or more processors not dedicated to cryptographic processing 306 are configured to perform non-cryptographic processing on the packets.
- Master processor 340 is configured to control networking functions other than forwarding, such as user authentication, Dynamic Host Configuration Protocol (DHCP) snooping, user entry table creation, deletion, and associative store entry aging, user device address (e.g. Media Access Control (MAC) address) learning, Web server IP address management, and the like, and to perform inter-processor synchronization to update the other processors 302 with current information.
- DHCP Dynamic Host Configuration Protocol
- MAC Media Access Control
- FIG. 4 is a block diagram that illustrates a scalable distributed architecture for Web-based authentication in accordance with one embodiment of the present invention.
- FIG. 4 is similar to FIG. 3 , except FIG. 4 includes an associative store for each input port of the network switch 400 ; associative stores 422 - 426 are associated with input ports 410 - 414 , respectively.
- network switch 400 comprises one or more input ports ( 410 - 414 ), an associative store ( 422 - 426 ) for each input port ( 410 - 414 ), one or more output ports ( 416 - 420 ), and a slave processor group 402 comprising one or more processors dedicated to cryptographic processing 404 and one or more processors not dedicated to cryptographic processing 406 .
- Network switch 400 also comprises a master processor 440 .
- a table such as a hash table may be used in lieu of one or more of associative stores 422 - 426 .
- Input ports 410 - 414 are coupled to associative stores 422 - 426 , respectively, and are configured to receive one or more packets on a packet-switched network.
- Output ports 416 - 420 are coupled to master processor 440 and are configured to send one or more packets to the packet-switched network.
- Associative stores 422 - 426 are configured to forward packet traffic to the one or more processors dedicated to cryptographic processing 404 if the destination port of the received packets indicates a secure communication transport protocol, such as SSL.
- Associative stores 422 - 426 are further configured to forward packet traffic from the network switch 400 to the one or more processors not dedicated to cryptographic processing 406 if the destination port of the received packets does not indicate a secure communication transport protocol.
- the one or more processors dedicated to cryptographic processing 404 are configured to perform cryptographic processing on packets
- the one or more processors not dedicated to cryptographic processing 406 are configured to perform non-cryptographic processing on the packets.
- Master processor 440 is configured to control networking functions other than forwarding, such as user authentication, Dynamic Host Configuration Protocol (DHCP) snooping, user entry table creation, deletion, and associative store entry aging, user device address (e.g. Media Access Control (MAC) address) learning, Web server IP address management, and the like, and to perform inter-processor synchronization to update the other processors 402 with current information.
- Master processor 440 is further configured to enable forwarding packets directly from an input port to an output port if the packets are from a user device that has been authenticated.
- FIG. 5 is a flow diagram that illustrates a method for Web-based authentication in accordance with one embodiment of the present invention.
- the processes illustrated in FIG. 5 may be implemented in hardware, software, firmware, or a combination thereof.
- the processes illustrated in FIG. 5 are performed by the network switch illustrated in FIG. 2 .
- the processes illustrated in FIG. 5 are performed by the network switch illustrated in FIG. 3 .
- the processes illustrated in FIG. 5 are performed by the network switch illustrated in FIG. 4 .
- one or more associative stores of a network switch are configured to forward packet traffic to a first one or more processors of the switch dedicated to cryptographic processing if the destination port of the packets indicates a secure transport protocol, and to a second one or more processors of the switch not dedicated to cryptographic processing if the destination port of the packets does not indicate a secure transport protocol.
- the network switch is configured to enable forwarding packets directly from an input port to an output port if the packets are from a user device that has been authenticated.
- FIG. 6 is a flow diagram that illustrates a method for Web-based authentication in accordance with one embodiment of the present invention.
- the processes illustrated in FIG. 6 may be implemented in hardware, software, firmware, or a combination thereof.
- the processes illustrated in FIG. 6 are performed by the network switch illustrated in FIG. 2 .
- the processes illustrated in FIG. 6 are performed by the network switch illustrated in FIG. 3 .
- the processes illustrated in FIG. 6 are performed by the network switch illustrated in FIG. 4 .
- a packet is received in a network switch having an associative store configured to forward packet traffic to a first one or more processors of the switch dedicated to cryptographic processing if the destination port indicates a secure transport protocol, and to a second one or more processors of the switch not dedicated to cryptographic processing if the destination port of the packets does not indicate a secure transport protocol.
- the source of the packet is an authenticated user, the packet is forwarded via an output port of the switch, based on the associative store.
- the source of a packet may be indicated by the user device address.
- An authenticated user may be indicated by a match when the user device address is used in a table lookup, or a “hit” when the user device address is used as key for a associative store associated with the input port of the network switch that received the packet.
- the packet is forwarded to a first one or more processors of the switch dedicated to cryptographic processing if the destination port of the packets indicates a secure transport protocol, and to a second one or more processors of the switch not dedicated to cryptographic processing if the destination port of the packet does not indicate a secure transport protocol.
- FIG. 7 is a flow diagram that illustrates a method for Web-based authentication in accordance with one embodiment of the present invention.
- the processes illustrated in FIG. 7 may be implemented in hardware, software, firmware, or a combination thereof.
- the processes illustrated in FIG. 7 are performed by the network switch illustrated in FIG. 2 .
- the processes illustrated in FIG. 7 are performed by the network switch illustrated in FIG. 3 .
- the processes illustrated in FIG. 7 are performed by the network switch illustrated in FIG. 4 .
- a packet is received in a network switch.
- packet type information is extracted from the packet.
- Example packet type information includes packet destination IP address, packet destination port, and packet source device address.
- a determination is made regarding whether the packet destination IP address matches the IP address of the switch. If the packet destination IP address matches the IP address of the switch, at 706 a determination is made regarding whether the packet destination port indicates a secure transport protocol. If the packet destination port indicates a secure transport protocol, at 708 , the packet is forwarded to a first one or more processors of the switch dedicated to cryptographic processing. If at 706 the packet destination port does not indicate a secure transport protocol, at 710 , the packet is forwarded to a second one or more processors of the switch not dedicated to cryptographic processing.
- FIG. 8 is a flow diagram that illustrates a method for forwarding a packet to a first one or more processors of a switch dedicated to cryptographic processing in accordance with one embodiment of the present invention.
- the processes illustrated in FIG. 8 may be implemented in hardware, software, firmware, or a combination thereof.
- FIG. 8 provides more detail for reference numeral 708 of FIG. 8 .
- the packet type information is hashed.
- the packet is forwarded based on the hash result.
- FIG. 9A is a block diagram that illustrates a method for forwarding a packet to a first one or more processors of a switch dedicated to cryptographic processing in accordance with one embodiment of the present invention.
- the packet is forwarded to one or more processors dedicated to cryptographic processing 910 at 906 if the destination port of the packet indicates a secure transport protocol.
- the packet is forwarded to one or more processors not dedicated to cryptographic processing 912 at 908 if the destination port of the packet does not indicate a secure transport protocol.
- FIG. 9B is a block diagram that illustrates a method for forwarding a packet to a first one or more processors of a switch dedicated to cryptographic processing in accordance with one embodiment of the present invention.
- the packet is forwarded to a particular processor dedicated to cryptographic processing 928 if the destination port of the packet indicates a secure transport protocol.
- the packet is forwarded to a particular processor not dedicated to cryptographic processing 930 at 926 if the destination port of the packet is not does not indicate a secure transport protocol.
- FIG. 10 is a flow diagram that illustrates a method for Web-based authentication in accordance with one embodiment of the present invention.
- the processes illustrated in FIG. 10 may be implemented in hardware, software, firmware, or a combination thereof.
- a packet is received from a user device.
- a determination is made regarding whether there is a associative store entry match for the user device address.
- An associative store entry match for the user device address indicates that the user device has been authenticated.
- the packet is forwarded based on the associative store entry.
- an associative store lookup is done based on the destination IP address and the destination port of the packet.
- a determination is made regarding whether (1) the destination IP address is the web server IP address and (2) the destination port indicates a secure transport protocol. If the destination IP address is not the web server IP address or the destination port does not indicate a secure transport protocol, at 1010 the packet is forwarded to one or more processors not dedicated to cryptographic processing.
- the one or more processors not dedicated to cryptographic processing creates a temporary user session and sends a redirection message to the user.
- the one or more processors dedicated to cryptographic processing forwards the decrypted user credentials to a processor configured to perform user authentication, create a user entry, and enable forwarding of packets directly from an input port to an output port if the packets are from a user device that has been authenticated.
- a processor configured to perform user authentication, create a user entry, and enable forwarding of packets directly from an input port to an output port if the packets are from a user device that has been authenticated.
- one of the processors not dedicated to cryptographic processing 206 performs these functions.
- master processor 340 performs these functions.
- master processor 440 performs these functions.
- the processor receives the user credentials and performs user authentication, create a user entry, and enable forwarding of packets directly from an input port to an output port if the packets are from a user device that has been authenticated.
- one Web server IP address is shared by all Web servers handled by a multiprocessor network switch.
- a master processor of the network switch is configured to handle Internet Control Message Protocol (ICMP) requests and responses for the shared Web server IP address, thus conserving IP addresses and providing users with the appearance of a single Web server. Packet traffic flow is forwarded to particular processor(s) as discussed above.
- ICMP Internet Control Message Protocol
- a multiprocessor network switch supports multiple virtual Web servers, allowing multiple Web servers in a multiple VLAN/subnet configuration. Similar to the single Web server configuration described above, users define different Web servers for different VLANs/subnets. Individual Web servers function as an individual Web server instance, responding to requests and responses. However, internally on a given processor of the network switch, all Web servers are bound to one real Web server. In other words, only one Web server is listening, using IP NAT (network address translation) and a tracking session to distinguish different flows. This embodiment is discussed in more detail below with respect to FIG. 11 .
- FIG. 11 is a block diagram that illustrates a scalable distributed architecture for Web-based multi-VLAN authentication in accordance with one embodiment of the present invention.
- VLANs 1100 , 1118 , 1122 , and 1108 interface with central Web server 1104 via virtual Web servers 1102 , 1116 , 1120 , and 1110 , respectively.
- Central Web server 1106 comprises an HTTP server 1106 , an HTTPS server 1112 , and a Web server address translator 1114 .
- HTTP server 1106 is configured to handle communications using the HyperText Transfer Protocol (HTTP).
- HTTPS server 1112 is configured to handle communications using the HyperText Transfer Protocol Secure (HTTPS).
- Web server address translator 1114 is configured to use IP NAT.
- FIG. 12 is a block diagram that illustrates a scalable distributed architecture for Web-based multi-VLAN authentication on the aggregation layer in accordance with one embodiment of the present invention.
- a multiprocessor network switch of the present invention is used at the aggregation layer to interface between the Internet 1200 , and between VLANs 1202 and 1212 via edge routers 1210 and 1220 of VLANs 1202 and 1212 , respectively.
Abstract
Description
Claims (21)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/461,700 US8667268B2 (en) | 2007-10-15 | 2012-05-01 | Scalable distributed web-based authentication |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US11/974,838 US8190881B2 (en) | 2007-10-15 | 2007-10-15 | Scalable distributed web-based authentication |
US13/461,700 US8667268B2 (en) | 2007-10-15 | 2012-05-01 | Scalable distributed web-based authentication |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/974,838 Continuation US8190881B2 (en) | 2007-10-15 | 2007-10-15 | Scalable distributed web-based authentication |
Publications (2)
Publication Number | Publication Date |
---|---|
US20120221849A1 US20120221849A1 (en) | 2012-08-30 |
US8667268B2 true US8667268B2 (en) | 2014-03-04 |
Family
ID=40535501
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/974,838 Active 2031-03-06 US8190881B2 (en) | 2007-10-15 | 2007-10-15 | Scalable distributed web-based authentication |
US13/458,979 Expired - Fee Related US8799645B2 (en) | 2007-10-15 | 2012-04-27 | Scalable distributed web-based authentication |
US13/461,700 Active US8667268B2 (en) | 2007-10-15 | 2012-05-01 | Scalable distributed web-based authentication |
Family Applications Before (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/974,838 Active 2031-03-06 US8190881B2 (en) | 2007-10-15 | 2007-10-15 | Scalable distributed web-based authentication |
US13/458,979 Expired - Fee Related US8799645B2 (en) | 2007-10-15 | 2012-04-27 | Scalable distributed web-based authentication |
Country Status (1)
Country | Link |
---|---|
US (3) | US8190881B2 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9798567B2 (en) | 2014-11-25 | 2017-10-24 | The Research Foundation For The State University Of New York | Multi-hypervisor virtual machines |
US11809891B2 (en) | 2018-06-01 | 2023-11-07 | The Research Foundation For The State University Of New York | Multi-hypervisor virtual machines that run on multiple co-located hypervisors |
Families Citing this family (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8190881B2 (en) | 2007-10-15 | 2012-05-29 | Foundry Networks Llc | Scalable distributed web-based authentication |
US9218469B2 (en) * | 2008-04-25 | 2015-12-22 | Hewlett Packard Enterprise Development Lp | System and method for installing authentication credentials on a network device |
US20120036207A1 (en) * | 2010-08-09 | 2012-02-09 | Bank Of America Corporation | Social media engagement system message routing and queuing |
US20120036201A1 (en) * | 2010-08-09 | 2012-02-09 | Bank Of America Corporation | Social media engagement system routing and message association |
US9215234B2 (en) * | 2012-01-24 | 2015-12-15 | Hewlett Packard Enterprise Development Lp | Security actions based on client identity databases |
US9584516B2 (en) * | 2015-01-26 | 2017-02-28 | Quest Software Inc. | Proxy authentication for a multiple core network device |
US9853903B1 (en) * | 2015-04-23 | 2017-12-26 | Cisco Technology, Inc. | Simultaneous redirecting and load balancing |
US9667619B1 (en) * | 2016-10-14 | 2017-05-30 | Akamai Technologies, Inc. | Systems and methods for utilizing client side authentication to select services available at a given port number |
Citations (150)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4683564A (en) | 1982-11-22 | 1987-07-28 | Data Switch Corporation | Matrix switch system |
US4791629A (en) | 1986-06-02 | 1988-12-13 | Ibm Corporation | Communications switching system |
US4807280A (en) | 1987-09-18 | 1989-02-21 | Pacific Bell | Cross-connect switch |
US4876681A (en) | 1987-05-15 | 1989-10-24 | Hitachi, Ltd. | Packet switching equipment and a packet switching method for controlling packet switched networks |
US4985889A (en) | 1988-02-04 | 1991-01-15 | Sprint International Communications Corporation | Data packet switching |
US5101404A (en) | 1988-08-26 | 1992-03-31 | Hitachi, Ltd. | Signalling apparatus for use in an ATM switching system |
US5195181A (en) | 1992-01-10 | 1993-03-16 | Digital Equipment Corporation | Message processing system having separate message receiving and transmitting processors with message processing being distributed between the separate processors |
US5301192A (en) | 1990-08-31 | 1994-04-05 | Alcatel N.V. | Temporary information storage system comprising a buffer memory storing data structured in fixed or variable length data blocks |
US5307345A (en) | 1992-06-25 | 1994-04-26 | Digital Equipment Corporation | Method and apparatus for cut-through data packet transfer in a bridge device |
US5323386A (en) | 1993-02-01 | 1994-06-21 | Trw Inc. | Expandable high speed serial data switch |
US5365512A (en) | 1993-07-02 | 1994-11-15 | Ericsson Ge Mobile Communications Inc. | Multisite trunked RF communication system with reliable control messaging network |
US5386471A (en) | 1994-01-25 | 1995-01-31 | Hughes Aircraft Company | Method and apparatus for securely conveying network control data across a cryptographic boundary |
US5390173A (en) | 1992-10-22 | 1995-02-14 | Digital Equipment Corporation | Packet format in hub for packet data communications system |
US5392279A (en) | 1992-01-17 | 1995-02-21 | Fujitsu Limited | Interconnection network with self-routing function |
US5406643A (en) | 1993-02-11 | 1995-04-11 | Motorola, Inc. | Method and apparatus for selecting between a plurality of communication paths |
US5408469A (en) | 1993-07-22 | 1995-04-18 | Synoptics Communications, Inc. | Routing device utilizing an ATM switch as a multi-channel backplane in a communication network |
US5430442A (en) | 1990-12-18 | 1995-07-04 | International Business Machines Corporation | Cross point switch with distributed control |
US5436893A (en) | 1992-12-05 | 1995-07-25 | Netcom Limited | ATM cell switch suitable for multicast switching |
US5461615A (en) | 1993-03-31 | 1995-10-24 | Alcatel N.V. | Asynchronous switching node distributing cells dynamically to outputs constituting an irregular group |
US5506840A (en) | 1992-12-18 | 1996-04-09 | Alcatel N.V. | Asynchronous switching node and routing logic means for a switching element used therein |
US5521923A (en) | 1993-08-27 | 1996-05-28 | Alcatel Sel Aktiengesellschaft | Method and facility for temporarily storing data packets, and exchange with such a facility |
US5546385A (en) | 1995-01-19 | 1996-08-13 | Intel Corporation | Flexible switching hub for a communication network |
US5550816A (en) | 1994-12-29 | 1996-08-27 | Storage Technology Corporation | Method and apparatus for virtual switching |
US5598410A (en) | 1994-12-29 | 1997-01-28 | Storage Technology Corporation | Method and apparatus for accelerated packet processing |
US5600795A (en) | 1993-08-28 | 1997-02-04 | U.S. Philips Corporation | Local network operating in asynchronous transfer mode (ATM) generating control cell containing information about the user, address of the station, and user-related identification |
US5619497A (en) | 1994-12-22 | 1997-04-08 | Emc Corporation | Method and apparatus for reordering frames |
US5640504A (en) | 1994-01-24 | 1997-06-17 | Advanced Computer Applications, Inc. | Distributed computing network |
US5663959A (en) | 1994-12-15 | 1997-09-02 | Nec Corporatiion | ATM cell switching apparatus having a control cell bypass route |
US5666353A (en) | 1995-03-21 | 1997-09-09 | Cisco Systems, Inc. | Frame based traffic policing for a digital switch |
US5732080A (en) | 1995-07-12 | 1998-03-24 | Bay Networks, Inc. | Method and apparatus for controlling data flow within a switching device |
US5815146A (en) | 1994-06-30 | 1998-09-29 | Hewlett-Packard Company | Video on demand system with multiple data sources configured to provide VCR-like services |
US5835496A (en) | 1996-04-30 | 1998-11-10 | Mcdata Corporation | Method and apparatus for data alignment |
US5838684A (en) | 1996-02-22 | 1998-11-17 | Fujitsu, Ltd. | Low latency, high clock frequency plesioasynchronous packet-based crossbar switching chip system and method |
US5862350A (en) | 1994-12-22 | 1999-01-19 | Intel Corporation | Method and mechanism for maintaining integrity within SCSI bus with hot insertion |
US5867675A (en) | 1996-08-06 | 1999-02-02 | Compaq Computer Corp | Apparatus and method for combining data streams with programmable wait states |
US5870538A (en) | 1995-07-19 | 1999-02-09 | Fujitsu Network Communications, Inc. | Switch fabric controller comparator system and method |
US5872783A (en) | 1996-07-24 | 1999-02-16 | Cisco Systems, Inc. | Arrangement for rendering forwarding decisions for packets transferred among network switches |
US5907660A (en) | 1994-09-21 | 1999-05-25 | Mitsubishi Denki Kabushiki Kaisha | Digital video signal playback device with special playback data being in the form of a still image slice data |
US5907566A (en) | 1997-05-29 | 1999-05-25 | 3Com Corporation | Continuous byte-stream encoder/decoder using frequency increase and cyclic redundancy check |
US5909686A (en) | 1997-06-30 | 1999-06-01 | Sun Microsystems, Inc. | Hardware-assisted central processing unit access to a forwarding database |
US5915094A (en) | 1994-12-06 | 1999-06-22 | International Business Machines Corporation | Disk access method for delivering multimedia and video information on demand over wide area networks |
US5936939A (en) | 1995-05-22 | 1999-08-10 | Fore Systems, Inc. | Digital network including early packet discard mechanism with adjustable threshold |
US5999528A (en) | 1994-04-29 | 1999-12-07 | Newbridge Networks Corporation | Communications system for receiving and transmitting data cells |
US6023471A (en) | 1997-10-07 | 2000-02-08 | Extreme Networks | Network interconnect device and protocol for communicating data among packet forwarding devices |
US6035414A (en) | 1996-11-08 | 2000-03-07 | Hitachi, Ltd. | Reliability of crossbar switches in an information processing system |
US6038288A (en) | 1997-12-31 | 2000-03-14 | Thomas; Gene Gilles | System and method for maintenance arbitration at a switching node |
US6076115A (en) | 1997-02-11 | 2000-06-13 | Xaqti Corporation | Media access control receiver and network management system |
US6088356A (en) | 1997-06-30 | 2000-07-11 | Sun Microsystems, Inc. | System and method for a multi-layer network element |
US6094434A (en) | 1996-12-30 | 2000-07-25 | Compaq Computer Corporation | Network switch with separate cut-through buffer |
US6118787A (en) | 1997-06-27 | 2000-09-12 | Advanced Micro Devices, Inc. | Apparatus and method for regulating assigned bandwidth in high speed packet switched networks |
US6125417A (en) | 1997-11-14 | 2000-09-26 | International Business Machines Corporation | Hot plug of adapters using optical switches |
US6128666A (en) | 1997-06-30 | 2000-10-03 | Sun Microsystems, Inc. | Distributed VLAN mechanism for packet field replacement in a multi-layered switched network element using a control field/signal for indicating modification of a packet with a database search engine |
US6144668A (en) | 1997-11-26 | 2000-11-07 | International Business Machines Corporation | Simultaneous cut through and store-and-forward frame support in a network device |
US6151301A (en) | 1995-05-11 | 2000-11-21 | Pmc-Sierra, Inc. | ATM architecture and switching element |
US6154446A (en) | 1998-07-08 | 2000-11-28 | Broadcom Corporation | Network switching architecture utilizing cell based and packet based per class-of-service head-of-line blocking prevention |
US6157643A (en) | 1996-11-06 | 2000-12-05 | Nokia Telecommunications Oy | Switching fabric |
US6160809A (en) | 1997-12-17 | 2000-12-12 | Compaq Computer Corporation | Distributed packet data with centralized snooping and header processing router |
US6172990B1 (en) | 1997-06-19 | 2001-01-09 | Xaqti Corporation | Media access control micro-RISC stream processor and method for implementing the same |
US6222845B1 (en) | 1997-02-25 | 2001-04-24 | Cascade Communications Corp. | System and method for providing unitary virtual circuit in digital network having communication links of diverse service types |
US6243667B1 (en) | 1996-05-28 | 2001-06-05 | Cisco Systems, Inc. | Network flow switching and flow data export |
US6272144B1 (en) | 1997-09-29 | 2001-08-07 | Agere Systems Guardian Corp. | In-band device configuration protocol for ATM transmission convergence devices |
US6320859B1 (en) | 1997-10-31 | 2001-11-20 | Nortel Networks Limited | Early availability of forwarding control information |
US20010048785A1 (en) | 2000-04-14 | 2001-12-06 | Steinberg Dan A. | Fiber optic array switch |
US20010053150A1 (en) | 2000-05-24 | 2001-12-20 | David Clear | Packet processor with programmable application logic |
US6333929B1 (en) | 1997-08-29 | 2001-12-25 | Intel Corporation | Packet format for a distributed system |
US20020007415A1 (en) | 2000-06-08 | 2002-01-17 | Frederick Douglis | Method for content distribution in a network supporting a security protocol |
US6343072B1 (en) | 1997-10-01 | 2002-01-29 | Cisco Technology, Inc. | Single-chip architecture for shared-memory router |
US20020012585A1 (en) | 2000-06-09 | 2002-01-31 | Broadcom Corporation | Gigabit switch with fast filtering processor |
US6356942B1 (en) | 1998-05-13 | 2002-03-12 | Axis Ab | Integrated circuit and method for bringing an integrated circuit to execute instructions |
US6356550B1 (en) | 1999-07-30 | 2002-03-12 | Mayan Networks Corporation | Flexible time division multiplexed bus using sonet formatting |
US6369855B1 (en) | 1996-11-01 | 2002-04-09 | Texas Instruments Incorporated | Audio and video decoder circuit and system |
US20020054594A1 (en) | 2000-11-07 | 2002-05-09 | Hoof Werner Van | Non-blocking, multi-context pipelined processor |
US20020069294A1 (en) | 2000-09-22 | 2002-06-06 | Ibm Corporation | Method and system for application specific packet forwarding |
US20020089977A1 (en) | 2000-11-17 | 2002-07-11 | Andrew Chang | Network switch cross point |
US20020091884A1 (en) | 2000-11-17 | 2002-07-11 | Andrew Chang | Method and system for translating data formats |
US6424659B2 (en) | 1998-07-17 | 2002-07-23 | Network Equipment Technologies, Inc. | Multi-layer switching apparatus and method |
US6424658B1 (en) | 1999-01-29 | 2002-07-23 | Neomagic Corp. | Store-and-forward network switch using an embedded DRAM |
US20020097713A1 (en) | 2000-11-17 | 2002-07-25 | Andrew Chang | Backplane interface adapter |
US20020105966A1 (en) | 2000-11-17 | 2002-08-08 | Ronak Patel | Backplane interface adapter with error control and redundant fabric |
US6457058B1 (en) | 1998-09-29 | 2002-09-24 | Cisco Technology, Inc. | Network switch with hash table look up |
US6477174B1 (en) | 1995-09-28 | 2002-11-05 | Cisco Technology, Inc. | Polling response selection using request monitoring in a network switch apparatus |
US6490280B1 (en) | 1999-03-31 | 2002-12-03 | Advanced Micro Devices, Inc. | Frame assembly in dequeuing block |
US6493347B2 (en) | 1996-12-16 | 2002-12-10 | Juniper Networks, Inc. | Memory organization in a switching device |
US20030009466A1 (en) | 2001-06-21 | 2003-01-09 | Ta John D. C. | Search engine with pipeline structure |
US20030033435A1 (en) | 2001-07-17 | 2003-02-13 | Hanner Brian D. | System and method for multidimensional data compression |
US20030043800A1 (en) | 2001-08-30 | 2003-03-06 | Sonksen Bradley Stephen | Dynamic data item processing |
US20030043825A1 (en) * | 2001-09-05 | 2003-03-06 | Andreas Magnussen | Hash-based data frame distribution for web switches |
US20030048785A1 (en) | 2001-08-28 | 2003-03-13 | International Business Machines Corporation | Network processor with single interface supporting tree search engine and CAM |
US6567404B1 (en) | 1997-08-22 | 2003-05-20 | Cisco Technologies, Inc. | Multiprotocol packet recognition and switching |
US6606300B1 (en) | 1998-02-19 | 2003-08-12 | International Business Machines Corporation | Flow control process for a switching system and system for performing the same |
US20030152084A1 (en) | 2001-09-19 | 2003-08-14 | Barry Lee | Differentiated services for a network processor |
US20030165160A1 (en) | 2001-04-24 | 2003-09-04 | Minami John Shigeto | Gigabit Ethernet adapter |
US20030174719A1 (en) | 2002-03-15 | 2003-09-18 | Broadcom Corporation | High speed protocol for interconnecting modular network devices |
US20030177221A1 (en) | 2002-03-18 | 2003-09-18 | Hamid Ould-Brahim | Resource allocation using an auto-discovery mechanism for provider-provisioned layer-2 and layer-3 Virtual Private Networks |
US6643269B1 (en) | 2000-03-03 | 2003-11-04 | Luminous Networks, Inc. | Routing switch automatically identifying network topology |
US20030215029A1 (en) | 2002-05-14 | 2003-11-20 | Limberg Allen Leroy | Adapative k-factor-improvement filter for receiver of radio signals subject to multipath distortion |
US6654370B1 (en) | 2000-06-30 | 2003-11-25 | Marconi Communications, Inc. | Backplane synchronization in a distributed system with clock drift and transport delay |
US6658002B1 (en) | 1998-06-30 | 2003-12-02 | Cisco Technology, Inc. | Logical operation unit for packet processing |
US6671275B1 (en) | 2002-08-02 | 2003-12-30 | Foundry Networks, Inc. | Cross-point switch with deadlock prevention |
US6681332B1 (en) | 2000-03-13 | 2004-01-20 | Analog Devices, Inc. | System and method to place a device in power down modes/states and restore back to first mode/state within user-controlled time window |
US6687247B1 (en) | 1999-10-27 | 2004-02-03 | Cisco Technology, Inc. | Architecture for high speed class of service enabled linecard |
US20040022263A1 (en) | 2002-08-02 | 2004-02-05 | Xiaodong Zhao | Cross point switch with out-of-band parameter fine tuning |
US6691202B2 (en) | 2000-12-22 | 2004-02-10 | Lucent Technologies Inc. | Ethernet cross point switch with reduced connections by using column control buses |
US6697368B2 (en) | 2000-11-17 | 2004-02-24 | Foundry Networks, Inc. | High-performance network switch |
US6696917B1 (en) | 2000-09-21 | 2004-02-24 | Nortel Networks Limited | Folded Clos architecture switching |
US6697359B1 (en) | 1999-07-02 | 2004-02-24 | Ancor Communications, Inc. | High performance switch fabric element and switch systems |
US6700894B1 (en) | 2000-03-15 | 2004-03-02 | Broadcom Corporation | Method and apparatus for shared buffer packet switching |
US6721313B1 (en) | 2000-08-01 | 2004-04-13 | International Business Machines Corporation | Switch fabric architecture using integrated serdes transceivers |
US6735218B2 (en) | 2000-11-17 | 2004-05-11 | Foundry Networks, Inc. | Method and system for encoding wide striped cells |
US6751224B1 (en) | 2000-03-30 | 2004-06-15 | Azanda Network Devices, Inc. | Integrated ATM/packet segmentation-and-reassembly engine for handling both packet and ATM input data and for outputting both ATM and packet data |
US6754881B2 (en) | 2001-12-10 | 2004-06-22 | International Business Machines Corporation | Field programmable network processor and method for customizing a network processor |
US6775706B1 (en) | 1999-06-18 | 2004-08-10 | Nec Corporation | Multi-protocol switching system, line interface and multi-protocol processing device |
US6778546B1 (en) | 2000-02-14 | 2004-08-17 | Cisco Technology, Inc. | High-speed hardware implementation of MDRR algorithm over a large number of queues |
US6789147B1 (en) | 2001-07-24 | 2004-09-07 | Cavium Networks | Interface for a security coprocessor |
US6792502B1 (en) | 2000-10-12 | 2004-09-14 | Freescale Semiconductor, Inc. | Microprocessor having a content addressable memory (CAM) device as a functional unit therein and method of operation |
US6798740B1 (en) | 2000-03-13 | 2004-09-28 | Nortel Networks Limited | Method and apparatus for switch core health monitoring and redundancy |
US6804731B1 (en) | 2000-08-11 | 2004-10-12 | Paion Company, Limited | System, method and article of manufacture for storing an incoming datagram in switch matrix in a switch fabric chipset system |
US6807363B1 (en) | 1999-10-29 | 2004-10-19 | Fujitsu Limited | Digital moving picture data player system having a time-based access list |
US6813243B1 (en) | 2000-02-14 | 2004-11-02 | Cisco Technology, Inc. | High-speed hardware implementation of red congestion control algorithm |
US6816467B1 (en) | 1997-06-30 | 2004-11-09 | Sun Microsystems, Inc. | Spanning tree support in a high performance network device |
US6831923B1 (en) | 1995-08-04 | 2004-12-14 | Cisco Technology, Inc. | Pipelined multiple issue packet switch |
US6839346B1 (en) | 1999-04-05 | 2005-01-04 | Nec Corporation | Packet switching apparatus with high speed routing function |
US6842422B1 (en) | 1999-06-15 | 2005-01-11 | Marconi Communications, Inc. | Data striping based switching system |
US6854117B1 (en) | 2000-10-31 | 2005-02-08 | Caspian Networks, Inc. | Parallel network processor array |
US20050041684A1 (en) | 1999-10-01 | 2005-02-24 | Agilent Technologies, Inc. | Multi-channel network monitoring apparatus, signal replicating device, and systems including such apparatus and devices, and enclosure for multi-processor equipment |
US6865153B1 (en) | 2000-09-20 | 2005-03-08 | Alcatel | Stage-implemented QoS shaping for data communication switch |
US20050089049A1 (en) | 2001-05-15 | 2005-04-28 | Foundry Networks, Inc. | High-performance network switch |
US6901072B1 (en) | 2003-05-15 | 2005-05-31 | Foundry Networks, Inc. | System and method for high speed packet transmission implementing dual transmit and receive pipelines |
US6920154B1 (en) | 2001-12-17 | 2005-07-19 | Supergate Technology Usa, Inc. | Architectures for a modularized data optimization engine and methods therefor |
US6925516B2 (en) | 2001-01-19 | 2005-08-02 | Raze Technologies, Inc. | System and method for providing an improved common control bus for use in on-line insertion of line replaceable units in wireless and wireline access systems |
US6937606B2 (en) | 2001-04-20 | 2005-08-30 | International Business Machines Corporation | Data structures for efficient processing of IP fragmentation and reassembly |
US6957258B2 (en) | 2001-03-28 | 2005-10-18 | Netrake Corporation | Policy gateway |
US7023863B1 (en) | 1999-10-29 | 2006-04-04 | 3Com Corporation | Apparatus and method for processing encrypted packets in a computer network device |
US7187687B1 (en) | 2002-05-06 | 2007-03-06 | Foundry Networks, Inc. | Pipeline method and system for switching packets |
US7240203B2 (en) | 2001-07-24 | 2007-07-03 | Cavium Networks, Inc. | Method and apparatus for establishing secure sessions |
US7266117B1 (en) | 2002-05-06 | 2007-09-04 | Foundry Networks, Inc. | System architecture for very fast ethernet blade |
US7305567B1 (en) | 2002-03-01 | 2007-12-04 | Cavium Networks, In. | Decoupled architecture for data ciphering operations |
US7337314B2 (en) | 2003-04-12 | 2008-02-26 | Cavium Networks, Inc. | Apparatus and method for allocating resources within a security processor |
US20080052773A1 (en) * | 2006-08-23 | 2008-02-28 | Cisco Technology, Inc. | Method and system for identifying and processing secure data frames |
US7382725B1 (en) * | 2004-03-09 | 2008-06-03 | Sun Microsystems, Inc. | Method and apparatus for scheduling packets in a multi-service integrated switch fabric |
US7398386B2 (en) | 2003-04-12 | 2008-07-08 | Cavium Networks, Inc. | Transparent IPSec processing inline between a framer and a network component |
US7468975B1 (en) | 2002-05-06 | 2008-12-23 | Foundry Networks, Inc. | Flexible method for processing data packets in a network routing system for enhanced efficiency and monitoring capability |
US20090100500A1 (en) | 2007-10-15 | 2009-04-16 | Foundry Networks, Inc. | Scalable distributed web-based authentication |
US20090279558A1 (en) | 2002-05-06 | 2009-11-12 | Ian Edward Davis | Network routing apparatus for enhanced efficiency and monitoring capability |
US7649885B1 (en) | 2002-05-06 | 2010-01-19 | Foundry Networks, Inc. | Network routing system for enhanced efficiency and monitoring capability |
US7657933B2 (en) | 2003-04-12 | 2010-02-02 | Cavium Networks, Inc. | Apparatus and method for allocating resources within a security processing architecture using multiple groups |
US7661130B2 (en) | 2003-04-12 | 2010-02-09 | Cavium Networks, Inc. | Apparatus and method for allocating resources within a security processing architecture using multiple queuing mechanisms |
US20100131658A1 (en) | 2008-11-26 | 2010-05-27 | Cavium Networks, Inc. | Multiple core Session Initiation Protocol (SIP) |
US7814310B2 (en) | 2003-04-12 | 2010-10-12 | Cavium Networks | IPsec performance optimization |
US7895431B2 (en) | 2004-09-10 | 2011-02-22 | Cavium Networks, Inc. | Packet queuing, scheduling and ordering |
Family Cites Families (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6750747B2 (en) * | 2002-08-29 | 2004-06-15 | Ljm Associates, Inc. | Proximity safety switch suitable for use in a hair dryer for disabling operation |
-
2007
- 2007-10-15 US US11/974,838 patent/US8190881B2/en active Active
-
2012
- 2012-04-27 US US13/458,979 patent/US8799645B2/en not_active Expired - Fee Related
- 2012-05-01 US US13/461,700 patent/US8667268B2/en active Active
Patent Citations (157)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4683564A (en) | 1982-11-22 | 1987-07-28 | Data Switch Corporation | Matrix switch system |
US4791629A (en) | 1986-06-02 | 1988-12-13 | Ibm Corporation | Communications switching system |
US4876681A (en) | 1987-05-15 | 1989-10-24 | Hitachi, Ltd. | Packet switching equipment and a packet switching method for controlling packet switched networks |
US4807280A (en) | 1987-09-18 | 1989-02-21 | Pacific Bell | Cross-connect switch |
US4985889A (en) | 1988-02-04 | 1991-01-15 | Sprint International Communications Corporation | Data packet switching |
US5101404A (en) | 1988-08-26 | 1992-03-31 | Hitachi, Ltd. | Signalling apparatus for use in an ATM switching system |
US5301192A (en) | 1990-08-31 | 1994-04-05 | Alcatel N.V. | Temporary information storage system comprising a buffer memory storing data structured in fixed or variable length data blocks |
US5430442A (en) | 1990-12-18 | 1995-07-04 | International Business Machines Corporation | Cross point switch with distributed control |
US5195181A (en) | 1992-01-10 | 1993-03-16 | Digital Equipment Corporation | Message processing system having separate message receiving and transmitting processors with message processing being distributed between the separate processors |
US5392279A (en) | 1992-01-17 | 1995-02-21 | Fujitsu Limited | Interconnection network with self-routing function |
US5307345A (en) | 1992-06-25 | 1994-04-26 | Digital Equipment Corporation | Method and apparatus for cut-through data packet transfer in a bridge device |
US5390173A (en) | 1992-10-22 | 1995-02-14 | Digital Equipment Corporation | Packet format in hub for packet data communications system |
US5436893A (en) | 1992-12-05 | 1995-07-25 | Netcom Limited | ATM cell switch suitable for multicast switching |
US5506840A (en) | 1992-12-18 | 1996-04-09 | Alcatel N.V. | Asynchronous switching node and routing logic means for a switching element used therein |
US5323386A (en) | 1993-02-01 | 1994-06-21 | Trw Inc. | Expandable high speed serial data switch |
US5406643A (en) | 1993-02-11 | 1995-04-11 | Motorola, Inc. | Method and apparatus for selecting between a plurality of communication paths |
US5461615A (en) | 1993-03-31 | 1995-10-24 | Alcatel N.V. | Asynchronous switching node distributing cells dynamically to outputs constituting an irregular group |
US5365512A (en) | 1993-07-02 | 1994-11-15 | Ericsson Ge Mobile Communications Inc. | Multisite trunked RF communication system with reliable control messaging network |
US5408469A (en) | 1993-07-22 | 1995-04-18 | Synoptics Communications, Inc. | Routing device utilizing an ATM switch as a multi-channel backplane in a communication network |
US5521923A (en) | 1993-08-27 | 1996-05-28 | Alcatel Sel Aktiengesellschaft | Method and facility for temporarily storing data packets, and exchange with such a facility |
US5600795A (en) | 1993-08-28 | 1997-02-04 | U.S. Philips Corporation | Local network operating in asynchronous transfer mode (ATM) generating control cell containing information about the user, address of the station, and user-related identification |
US5640504A (en) | 1994-01-24 | 1997-06-17 | Advanced Computer Applications, Inc. | Distributed computing network |
US5386471A (en) | 1994-01-25 | 1995-01-31 | Hughes Aircraft Company | Method and apparatus for securely conveying network control data across a cryptographic boundary |
US5999528A (en) | 1994-04-29 | 1999-12-07 | Newbridge Networks Corporation | Communications system for receiving and transmitting data cells |
US5815146A (en) | 1994-06-30 | 1998-09-29 | Hewlett-Packard Company | Video on demand system with multiple data sources configured to provide VCR-like services |
US5907660A (en) | 1994-09-21 | 1999-05-25 | Mitsubishi Denki Kabushiki Kaisha | Digital video signal playback device with special playback data being in the form of a still image slice data |
US5915094A (en) | 1994-12-06 | 1999-06-22 | International Business Machines Corporation | Disk access method for delivering multimedia and video information on demand over wide area networks |
US5663959A (en) | 1994-12-15 | 1997-09-02 | Nec Corporatiion | ATM cell switching apparatus having a control cell bypass route |
US5619497A (en) | 1994-12-22 | 1997-04-08 | Emc Corporation | Method and apparatus for reordering frames |
US5862350A (en) | 1994-12-22 | 1999-01-19 | Intel Corporation | Method and mechanism for maintaining integrity within SCSI bus with hot insertion |
US5598410A (en) | 1994-12-29 | 1997-01-28 | Storage Technology Corporation | Method and apparatus for accelerated packet processing |
US5550816A (en) | 1994-12-29 | 1996-08-27 | Storage Technology Corporation | Method and apparatus for virtual switching |
US5546385A (en) | 1995-01-19 | 1996-08-13 | Intel Corporation | Flexible switching hub for a communication network |
US5666353A (en) | 1995-03-21 | 1997-09-09 | Cisco Systems, Inc. | Frame based traffic policing for a digital switch |
US6151301A (en) | 1995-05-11 | 2000-11-21 | Pmc-Sierra, Inc. | ATM architecture and switching element |
US5936939A (en) | 1995-05-22 | 1999-08-10 | Fore Systems, Inc. | Digital network including early packet discard mechanism with adjustable threshold |
US5732080A (en) | 1995-07-12 | 1998-03-24 | Bay Networks, Inc. | Method and apparatus for controlling data flow within a switching device |
US5870538A (en) | 1995-07-19 | 1999-02-09 | Fujitsu Network Communications, Inc. | Switch fabric controller comparator system and method |
US6831923B1 (en) | 1995-08-04 | 2004-12-14 | Cisco Technology, Inc. | Pipelined multiple issue packet switch |
US6477174B1 (en) | 1995-09-28 | 2002-11-05 | Cisco Technology, Inc. | Polling response selection using request monitoring in a network switch apparatus |
US5838684A (en) | 1996-02-22 | 1998-11-17 | Fujitsu, Ltd. | Low latency, high clock frequency plesioasynchronous packet-based crossbar switching chip system and method |
US5835496A (en) | 1996-04-30 | 1998-11-10 | Mcdata Corporation | Method and apparatus for data alignment |
US6243667B1 (en) | 1996-05-28 | 2001-06-05 | Cisco Systems, Inc. | Network flow switching and flow data export |
US5872783A (en) | 1996-07-24 | 1999-02-16 | Cisco Systems, Inc. | Arrangement for rendering forwarding decisions for packets transferred among network switches |
US5867675A (en) | 1996-08-06 | 1999-02-02 | Compaq Computer Corp | Apparatus and method for combining data streams with programmable wait states |
US6369855B1 (en) | 1996-11-01 | 2002-04-09 | Texas Instruments Incorporated | Audio and video decoder circuit and system |
US6157643A (en) | 1996-11-06 | 2000-12-05 | Nokia Telecommunications Oy | Switching fabric |
US6035414A (en) | 1996-11-08 | 2000-03-07 | Hitachi, Ltd. | Reliability of crossbar switches in an information processing system |
US6493347B2 (en) | 1996-12-16 | 2002-12-10 | Juniper Networks, Inc. | Memory organization in a switching device |
US6094434A (en) | 1996-12-30 | 2000-07-25 | Compaq Computer Corporation | Network switch with separate cut-through buffer |
US6076115A (en) | 1997-02-11 | 2000-06-13 | Xaqti Corporation | Media access control receiver and network management system |
US6222845B1 (en) | 1997-02-25 | 2001-04-24 | Cascade Communications Corp. | System and method for providing unitary virtual circuit in digital network having communication links of diverse service types |
US5907566A (en) | 1997-05-29 | 1999-05-25 | 3Com Corporation | Continuous byte-stream encoder/decoder using frequency increase and cyclic redundancy check |
US6172990B1 (en) | 1997-06-19 | 2001-01-09 | Xaqti Corporation | Media access control micro-RISC stream processor and method for implementing the same |
US6118787A (en) | 1997-06-27 | 2000-09-12 | Advanced Micro Devices, Inc. | Apparatus and method for regulating assigned bandwidth in high speed packet switched networks |
US5909686A (en) | 1997-06-30 | 1999-06-01 | Sun Microsystems, Inc. | Hardware-assisted central processing unit access to a forwarding database |
US6128666A (en) | 1997-06-30 | 2000-10-03 | Sun Microsystems, Inc. | Distributed VLAN mechanism for packet field replacement in a multi-layered switched network element using a control field/signal for indicating modification of a packet with a database search engine |
US6816467B1 (en) | 1997-06-30 | 2004-11-09 | Sun Microsystems, Inc. | Spanning tree support in a high performance network device |
US6088356A (en) | 1997-06-30 | 2000-07-11 | Sun Microsystems, Inc. | System and method for a multi-layer network element |
US6567404B1 (en) | 1997-08-22 | 2003-05-20 | Cisco Technologies, Inc. | Multiprotocol packet recognition and switching |
US6333929B1 (en) | 1997-08-29 | 2001-12-25 | Intel Corporation | Packet format for a distributed system |
US6272144B1 (en) | 1997-09-29 | 2001-08-07 | Agere Systems Guardian Corp. | In-band device configuration protocol for ATM transmission convergence devices |
US6343072B1 (en) | 1997-10-01 | 2002-01-29 | Cisco Technology, Inc. | Single-chip architecture for shared-memory router |
US6023471A (en) | 1997-10-07 | 2000-02-08 | Extreme Networks | Network interconnect device and protocol for communicating data among packet forwarding devices |
US6320859B1 (en) | 1997-10-31 | 2001-11-20 | Nortel Networks Limited | Early availability of forwarding control information |
US6125417A (en) | 1997-11-14 | 2000-09-26 | International Business Machines Corporation | Hot plug of adapters using optical switches |
US6144668A (en) | 1997-11-26 | 2000-11-07 | International Business Machines Corporation | Simultaneous cut through and store-and-forward frame support in a network device |
US6160809A (en) | 1997-12-17 | 2000-12-12 | Compaq Computer Corporation | Distributed packet data with centralized snooping and header processing router |
US6038288A (en) | 1997-12-31 | 2000-03-14 | Thomas; Gene Gilles | System and method for maintenance arbitration at a switching node |
US6606300B1 (en) | 1998-02-19 | 2003-08-12 | International Business Machines Corporation | Flow control process for a switching system and system for performing the same |
US6356942B1 (en) | 1998-05-13 | 2002-03-12 | Axis Ab | Integrated circuit and method for bringing an integrated circuit to execute instructions |
US6658002B1 (en) | 1998-06-30 | 2003-12-02 | Cisco Technology, Inc. | Logical operation unit for packet processing |
US6335932B2 (en) | 1998-07-08 | 2002-01-01 | Broadcom Corporation | High performance self balancing low cost network switching architecture based on distributed hierarchical shared memory |
US6335935B2 (en) | 1998-07-08 | 2002-01-01 | Broadcom Corporation | Network switching architecture with fast filtering processor |
US6154446A (en) | 1998-07-08 | 2000-11-28 | Broadcom Corporation | Network switching architecture utilizing cell based and packet based per class-of-service head-of-line blocking prevention |
US6424659B2 (en) | 1998-07-17 | 2002-07-23 | Network Equipment Technologies, Inc. | Multi-layer switching apparatus and method |
US6457058B1 (en) | 1998-09-29 | 2002-09-24 | Cisco Technology, Inc. | Network switch with hash table look up |
US6424658B1 (en) | 1999-01-29 | 2002-07-23 | Neomagic Corp. | Store-and-forward network switch using an embedded DRAM |
US6490280B1 (en) | 1999-03-31 | 2002-12-03 | Advanced Micro Devices, Inc. | Frame assembly in dequeuing block |
US6839346B1 (en) | 1999-04-05 | 2005-01-04 | Nec Corporation | Packet switching apparatus with high speed routing function |
US6842422B1 (en) | 1999-06-15 | 2005-01-11 | Marconi Communications, Inc. | Data striping based switching system |
US6775706B1 (en) | 1999-06-18 | 2004-08-10 | Nec Corporation | Multi-protocol switching system, line interface and multi-protocol processing device |
US6697359B1 (en) | 1999-07-02 | 2004-02-24 | Ancor Communications, Inc. | High performance switch fabric element and switch systems |
US6356550B1 (en) | 1999-07-30 | 2002-03-12 | Mayan Networks Corporation | Flexible time division multiplexed bus using sonet formatting |
US20050041684A1 (en) | 1999-10-01 | 2005-02-24 | Agilent Technologies, Inc. | Multi-channel network monitoring apparatus, signal replicating device, and systems including such apparatus and devices, and enclosure for multi-processor equipment |
US6687247B1 (en) | 1999-10-27 | 2004-02-03 | Cisco Technology, Inc. | Architecture for high speed class of service enabled linecard |
US6807363B1 (en) | 1999-10-29 | 2004-10-19 | Fujitsu Limited | Digital moving picture data player system having a time-based access list |
US7023863B1 (en) | 1999-10-29 | 2006-04-04 | 3Com Corporation | Apparatus and method for processing encrypted packets in a computer network device |
US6813243B1 (en) | 2000-02-14 | 2004-11-02 | Cisco Technology, Inc. | High-speed hardware implementation of red congestion control algorithm |
US6778546B1 (en) | 2000-02-14 | 2004-08-17 | Cisco Technology, Inc. | High-speed hardware implementation of MDRR algorithm over a large number of queues |
US6643269B1 (en) | 2000-03-03 | 2003-11-04 | Luminous Networks, Inc. | Routing switch automatically identifying network topology |
US6681332B1 (en) | 2000-03-13 | 2004-01-20 | Analog Devices, Inc. | System and method to place a device in power down modes/states and restore back to first mode/state within user-controlled time window |
US6798740B1 (en) | 2000-03-13 | 2004-09-28 | Nortel Networks Limited | Method and apparatus for switch core health monitoring and redundancy |
US6700894B1 (en) | 2000-03-15 | 2004-03-02 | Broadcom Corporation | Method and apparatus for shared buffer packet switching |
US6751224B1 (en) | 2000-03-30 | 2004-06-15 | Azanda Network Devices, Inc. | Integrated ATM/packet segmentation-and-reassembly engine for handling both packet and ATM input data and for outputting both ATM and packet data |
US20010048785A1 (en) | 2000-04-14 | 2001-12-06 | Steinberg Dan A. | Fiber optic array switch |
US20010053150A1 (en) | 2000-05-24 | 2001-12-20 | David Clear | Packet processor with programmable application logic |
US20020007415A1 (en) | 2000-06-08 | 2002-01-17 | Frederick Douglis | Method for content distribution in a network supporting a security protocol |
US20020012585A1 (en) | 2000-06-09 | 2002-01-31 | Broadcom Corporation | Gigabit switch with fast filtering processor |
US6654370B1 (en) | 2000-06-30 | 2003-11-25 | Marconi Communications, Inc. | Backplane synchronization in a distributed system with clock drift and transport delay |
US6721313B1 (en) | 2000-08-01 | 2004-04-13 | International Business Machines Corporation | Switch fabric architecture using integrated serdes transceivers |
US6804731B1 (en) | 2000-08-11 | 2004-10-12 | Paion Company, Limited | System, method and article of manufacture for storing an incoming datagram in switch matrix in a switch fabric chipset system |
US6865153B1 (en) | 2000-09-20 | 2005-03-08 | Alcatel | Stage-implemented QoS shaping for data communication switch |
US6696917B1 (en) | 2000-09-21 | 2004-02-24 | Nortel Networks Limited | Folded Clos architecture switching |
US20020069294A1 (en) | 2000-09-22 | 2002-06-06 | Ibm Corporation | Method and system for application specific packet forwarding |
US6792502B1 (en) | 2000-10-12 | 2004-09-14 | Freescale Semiconductor, Inc. | Microprocessor having a content addressable memory (CAM) device as a functional unit therein and method of operation |
US6854117B1 (en) | 2000-10-31 | 2005-02-08 | Caspian Networks, Inc. | Parallel network processor array |
US20020054594A1 (en) | 2000-11-07 | 2002-05-09 | Hoof Werner Van | Non-blocking, multi-context pipelined processor |
US20040179548A1 (en) | 2000-11-17 | 2004-09-16 | Andrew Chang | Method and system for encoding wide striped cells |
US20020089977A1 (en) | 2000-11-17 | 2002-07-11 | Andrew Chang | Network switch cross point |
US6735218B2 (en) | 2000-11-17 | 2004-05-11 | Foundry Networks, Inc. | Method and system for encoding wide striped cells |
US7203194B2 (en) | 2000-11-17 | 2007-04-10 | Foundry Networks, Inc. | Method and system for encoding wide striped cells |
US20020097713A1 (en) | 2000-11-17 | 2002-07-25 | Andrew Chang | Backplane interface adapter |
US6697368B2 (en) | 2000-11-17 | 2004-02-24 | Foundry Networks, Inc. | High-performance network switch |
US20020091884A1 (en) | 2000-11-17 | 2002-07-11 | Andrew Chang | Method and system for translating data formats |
US20020105966A1 (en) | 2000-11-17 | 2002-08-08 | Ronak Patel | Backplane interface adapter with error control and redundant fabric |
US6691202B2 (en) | 2000-12-22 | 2004-02-10 | Lucent Technologies Inc. | Ethernet cross point switch with reduced connections by using column control buses |
US6925516B2 (en) | 2001-01-19 | 2005-08-02 | Raze Technologies, Inc. | System and method for providing an improved common control bus for use in on-line insertion of line replaceable units in wireless and wireline access systems |
US6957258B2 (en) | 2001-03-28 | 2005-10-18 | Netrake Corporation | Policy gateway |
US6937606B2 (en) | 2001-04-20 | 2005-08-30 | International Business Machines Corporation | Data structures for efficient processing of IP fragmentation and reassembly |
US20030165160A1 (en) | 2001-04-24 | 2003-09-04 | Minami John Shigeto | Gigabit Ethernet adapter |
US7206283B2 (en) | 2001-05-15 | 2007-04-17 | Foundry Networks, Inc. | High-performance network switch |
US20050089049A1 (en) | 2001-05-15 | 2005-04-28 | Foundry Networks, Inc. | High-performance network switch |
US20030009466A1 (en) | 2001-06-21 | 2003-01-09 | Ta John D. C. | Search engine with pipeline structure |
US20030033435A1 (en) | 2001-07-17 | 2003-02-13 | Hanner Brian D. | System and method for multidimensional data compression |
US7240203B2 (en) | 2001-07-24 | 2007-07-03 | Cavium Networks, Inc. | Method and apparatus for establishing secure sessions |
US6789147B1 (en) | 2001-07-24 | 2004-09-07 | Cavium Networks | Interface for a security coprocessor |
US20030048785A1 (en) | 2001-08-28 | 2003-03-13 | International Business Machines Corporation | Network processor with single interface supporting tree search engine and CAM |
US20030043800A1 (en) | 2001-08-30 | 2003-03-06 | Sonksen Bradley Stephen | Dynamic data item processing |
US20030043825A1 (en) * | 2001-09-05 | 2003-03-06 | Andreas Magnussen | Hash-based data frame distribution for web switches |
US20030152084A1 (en) | 2001-09-19 | 2003-08-14 | Barry Lee | Differentiated services for a network processor |
US6754881B2 (en) | 2001-12-10 | 2004-06-22 | International Business Machines Corporation | Field programmable network processor and method for customizing a network processor |
US6920154B1 (en) | 2001-12-17 | 2005-07-19 | Supergate Technology Usa, Inc. | Architectures for a modularized data optimization engine and methods therefor |
US7305567B1 (en) | 2002-03-01 | 2007-12-04 | Cavium Networks, In. | Decoupled architecture for data ciphering operations |
US20030174719A1 (en) | 2002-03-15 | 2003-09-18 | Broadcom Corporation | High speed protocol for interconnecting modular network devices |
US20030177221A1 (en) | 2002-03-18 | 2003-09-18 | Hamid Ould-Brahim | Resource allocation using an auto-discovery mechanism for provider-provisioned layer-2 and layer-3 Virtual Private Networks |
US7468975B1 (en) | 2002-05-06 | 2008-12-23 | Foundry Networks, Inc. | Flexible method for processing data packets in a network routing system for enhanced efficiency and monitoring capability |
US7187687B1 (en) | 2002-05-06 | 2007-03-06 | Foundry Networks, Inc. | Pipeline method and system for switching packets |
US7649885B1 (en) | 2002-05-06 | 2010-01-19 | Foundry Networks, Inc. | Network routing system for enhanced efficiency and monitoring capability |
US7738450B1 (en) | 2002-05-06 | 2010-06-15 | Foundry Networks, Inc. | System architecture for very fast ethernet blade |
US7266117B1 (en) | 2002-05-06 | 2007-09-04 | Foundry Networks, Inc. | System architecture for very fast ethernet blade |
US20090279558A1 (en) | 2002-05-06 | 2009-11-12 | Ian Edward Davis | Network routing apparatus for enhanced efficiency and monitoring capability |
US20030215029A1 (en) | 2002-05-14 | 2003-11-20 | Limberg Allen Leroy | Adapative k-factor-improvement filter for receiver of radio signals subject to multipath distortion |
US20040022263A1 (en) | 2002-08-02 | 2004-02-05 | Xiaodong Zhao | Cross point switch with out-of-band parameter fine tuning |
US6671275B1 (en) | 2002-08-02 | 2003-12-30 | Foundry Networks, Inc. | Cross-point switch with deadlock prevention |
US7337314B2 (en) | 2003-04-12 | 2008-02-26 | Cavium Networks, Inc. | Apparatus and method for allocating resources within a security processor |
US7661130B2 (en) | 2003-04-12 | 2010-02-09 | Cavium Networks, Inc. | Apparatus and method for allocating resources within a security processing architecture using multiple queuing mechanisms |
US7398386B2 (en) | 2003-04-12 | 2008-07-08 | Cavium Networks, Inc. | Transparent IPSec processing inline between a framer and a network component |
US7657933B2 (en) | 2003-04-12 | 2010-02-02 | Cavium Networks, Inc. | Apparatus and method for allocating resources within a security processing architecture using multiple groups |
US7814310B2 (en) | 2003-04-12 | 2010-10-12 | Cavium Networks | IPsec performance optimization |
US20050175018A1 (en) | 2003-05-15 | 2005-08-11 | Wong Yuen F. | System and method for high speed packet transmission implementing dual transmit and receive pipelines |
US6901072B1 (en) | 2003-05-15 | 2005-05-31 | Foundry Networks, Inc. | System and method for high speed packet transmission implementing dual transmit and receive pipelines |
US7382725B1 (en) * | 2004-03-09 | 2008-06-03 | Sun Microsystems, Inc. | Method and apparatus for scheduling packets in a multi-service integrated switch fabric |
US7895431B2 (en) | 2004-09-10 | 2011-02-22 | Cavium Networks, Inc. | Packet queuing, scheduling and ordering |
US20080052773A1 (en) * | 2006-08-23 | 2008-02-28 | Cisco Technology, Inc. | Method and system for identifying and processing secure data frames |
US20090100500A1 (en) | 2007-10-15 | 2009-04-16 | Foundry Networks, Inc. | Scalable distributed web-based authentication |
US20100131658A1 (en) | 2008-11-26 | 2010-05-27 | Cavium Networks, Inc. | Multiple core Session Initiation Protocol (SIP) |
Non-Patent Citations (36)
Title |
---|
"17×17 3.2 Gbps Crosspoint Switch with Input Equalization-M21110," Mindspeed, Feb. 1, 2001, 2 pages. |
"Accelerating the Standard for Speed," Gigabit Ethernet Alliance, Whitepaper, 1998, 19 pages. |
"Biglron Architecture Technical Brief," Foundry Networks, Version 1.0, Oct. 1998, 15 pages. |
"Biglron Architecture Technical Brief," Foundry Networks, Version 1.02, Oct. 1998, 15 pages. |
"Biglron Architecture Technical Brief," Foundry Networks, Version 1.03, Dec. 1998, 14 pages. |
"Biglron Architecture Technical Brief," Foundry Networks, Version 2.0, May 1999, 15 pages. |
"Biglron Architecture Technical Brief," Foundry Networks, Version 2.01, May 1999, 15 pages. |
"Biglron Architecture Technical Brief," Foundry Networks, Version 2.02, Jul. 2001, 16 pages. |
"Foundry Networks, Inc.-Biglron 4000, Layer 2 & Layer 3 Interoperability Evaluation," The Tolly Group, No. 199133, Oct. 1999, 4 pages. |
"Foundry Networks, Inc.—Biglron 4000, Layer 2 & Layer 3 Interoperability Evaluation," The Tolly Group, No. 199133, Oct. 1999, 4 pages. |
"Foundry Networks, Inc.-Biglron 8000 Gigabit Ethernet Switching Router, Layer 2 & Layer 3 Performance Evaluation," The Tolly Group, No. 199111, May, 1999, 4 pages. |
"Foundry Networks, Inc.—Biglron 8000 Gigabit Ethernet Switching Router, Layer 2 & Layer 3 Performance Evaluation," The Tolly Group, No. 199111, May, 1999, 4 pages. |
"JetCore Based Chassis Systems-An Architecture Brief on Netlron, Biglron, and Fastlron Systems," Foundry Networks, Jan. 17, 2003, 27 pages. |
"JetCore Based Chassis Systems—An Architecture Brief on Netlron, Biglron, and Fastlron Systems," Foundry Networks, Jan. 17, 2003, 27 pages. |
"Lab Testing Summary Report-Product Category: Layer-3 Switches, Vendor Tested: Foundry Networks, Product Tested: Biglron 4000," Mier Communications, Inc., Report No. 231198, Oct. 1998, 6 pages. |
"Next Generation Terabit System Architecture .The High Performance Revolution for 10 Gigabit Networks," Foundry Networks, Nov. 17, 2003, 27 pages. |
"Next Generation Terabit System Architecture •The High Performance Revolution for 10 Gigabit Networks," Foundry Networks, Nov. 17, 2003, 27 pages. |
"Nitrox III Family of Security Processors," CAVIUM Networks, Security Processors, Product Brief, 2011, 2 pages. |
"Nitrox PX Family of Security Processors," CAVIUM Networks, Security Processors, Product Brief, 2008, 2 pages. |
"Switch Fabric Chipset-X27300 iScale.TM.," Mindspeed, Apr. 30, 2001, 2 pages. |
"Technology Overview," 10 Gigabit Ethernet Alliance, Whitepaper, Sep. 2001, 16 pages. |
Brand, R., "Interconnection with Wide Area Networks," 10 Gigabit Ethernet Alliance, Version 1.0, Mar. 2002, 5 pages. |
Degermark, M. et al., "Small Forwarding Tables for Fast Routing Lookups," ACM Computer Communications Review, vol. 27, No. 4, Oct. 1997, 12 pages. |
Kichorowsky, R., et al., "Mindspeed.TM. Switch Fabric Offers the Most Comprehensive Solution for Multi-Protocol Networking Equipment," Apr. 30, 2001, 3 pages. |
Matsumoto, C. et al., "Switch Fabrics Touted At Interconnects Conference," Aug. 21, 2000, URL: http://www.eetimes.comistory/OEG20000821S0011, accessed Aug. 12, 2002, 2 pages. |
McAuley, A., et al., "Fast Routing Table Lookup Using CAMs," Proceedings of INFOCOM, Mar.-Apr. 1993, pp. 1382-1391. |
Mier Communications, Inc.,"Lab Testing Summary Report-Product Category: Gigabit Backbone Switches, Vendor Tested: Foundry Networks, Product Tested: Biglron 4000," Report No. 210998, Sep. 1998, 6 pages. |
Notice of Allowance in U.S. Appl. No. 11/974,838, mailed Apr. 12, 2012. |
Office Action in U.S. Appl. No. 11/974,838, mailed Apr. 1, 2011. |
Office Action in U.S. Appl. No. 11/974,838, mailed Aug. 15, 2011. |
Office Action in U.S. Appl. No. 11/974,838, mailed Nov. 28, 2011. |
Office Action in U.S. Appl. No. 11/974,838, mailed Sep. 28, 2010. |
Office Action in U.S. Appl. No. 13/458,979, mailed Feb. 4, 2013. |
Office Action in U.S. Appl. No. 13/458,979, mailed Oct. 23, 2013. |
U.S. Appl. No. 10/140,751, filed May 6, 2002. |
U.S. Appl. No. 10/140,753, filed May 6, 2002. |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9798567B2 (en) | 2014-11-25 | 2017-10-24 | The Research Foundation For The State University Of New York | Multi-hypervisor virtual machines |
US10437627B2 (en) | 2014-11-25 | 2019-10-08 | The Research Foundation For The State University Of New York | Multi-hypervisor virtual machines |
US11003485B2 (en) | 2014-11-25 | 2021-05-11 | The Research Foundation for the State University | Multi-hypervisor virtual machines |
US11809891B2 (en) | 2018-06-01 | 2023-11-07 | The Research Foundation For The State University Of New York | Multi-hypervisor virtual machines that run on multiple co-located hypervisors |
Also Published As
Publication number | Publication date |
---|---|
US20090100500A1 (en) | 2009-04-16 |
US20120216254A1 (en) | 2012-08-23 |
US20120221849A1 (en) | 2012-08-30 |
US8799645B2 (en) | 2014-08-05 |
US8190881B2 (en) | 2012-05-29 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8667268B2 (en) | Scalable distributed web-based authentication | |
US8850219B2 (en) | Secure communications | |
US9525666B2 (en) | Methods and systems for managing concurrent unsecured and cryptographically secure communications across unsecured networks | |
EP3557822A1 (en) | Fully qualified domain name-based traffic control for virtual private network access control | |
US10776489B2 (en) | Methods and systems for providing and controlling cryptographic secure communications terminal operable to provide a plurality of desktop environments | |
US6751728B1 (en) | System and method of transmitting encrypted packets through a network access point | |
US7533409B2 (en) | Methods and systems for firewalling virtual private networks | |
US8046821B2 (en) | Mechanism and method for controlling network access to a service provider | |
US8191131B2 (en) | Obscuring authentication data of remote user | |
US20180234256A1 (en) | Network security with surrogate digital certificates | |
WO2007016436A2 (en) | Segmented network identity management | |
US11133933B1 (en) | Rapid secure authentication and communications through multitenant components in provider networks | |
US10389693B2 (en) | Keys for encrypted disk partitions | |
US7849504B2 (en) | Network security devices and methods | |
US11368487B2 (en) | Applying security policies to web traffic while maintaining privacy | |
US7818785B2 (en) | System and method for secure information handling system memory | |
US20220345491A1 (en) | Systems and methods for scalable zero trust security processing | |
US9596217B2 (en) | Manage encrypted network traffic using spoofed addresses | |
US8087066B2 (en) | Method and system for securing a commercial grid network | |
US11297036B1 (en) | Single whitelisted ingress endpoint on 1 and 2 way TLS connections | |
KR20140028615A (en) | Network separation device using one time password, network separation system and method thereof | |
KR20130136017A (en) | The method and system for web-site sign on using an object of web storage |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: FOUNDRY NETWORKS, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:WANG, YAN-ZHE;HOU, SEAN;DEVARAPALLI, SRIDHAR;AND OTHERS;SIGNING DATES FROM 20071004 TO 20071221;REEL/FRAME:028832/0702 |
|
AS | Assignment |
Owner name: FOUNDRY NETWORKS, LLC, CALIFORNIA Free format text: CHANGE OF NAME;ASSIGNOR:FOUNDRY NETWORKS, INC.;REEL/FRAME:029956/0602 Effective date: 20090511 |
|
FEPP | Fee payment procedure |
Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
FEPP | Fee payment procedure |
Free format text: SURCHARGE FOR LATE PAYMENT, LARGE ENTITY (ORIGINAL EVENT CODE: M1554) |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551) Year of fee payment: 4 |
|
AS | Assignment |
Owner name: AVAGO TECHNOLOGIES INTERNATIONAL SALES PTE. LIMITED, SINGAPORE Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BROCADE COMMUNICATIONS SYSTEMS LLC;REEL/FRAME:047270/0247 Effective date: 20180905 Owner name: AVAGO TECHNOLOGIES INTERNATIONAL SALES PTE. LIMITE Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BROCADE COMMUNICATIONS SYSTEMS LLC;REEL/FRAME:047270/0247 Effective date: 20180905 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 8 |